Skip to content

v1.8.5 — Chromium OAuth login fix + DB-enforced email uniqueness

Choose a tag to compare

View all tags
@clem-field clem-field released this 29 May 10:54
v1.8.5
f85db6f

v1.8.5 — Chromium OAuth login fix + DB-enforced email uniqueness

Patch release. Restores SSO login in Chromium browsers, hardens email-identity uniqueness at the database layer, and dispositions two newly-published base-image CVEs.

Fixed

  • OAuth/OIDC login silently failing in Chrome & Edge (#593). The GitHub and Okta/OIDC "Sign in" buttons did nothing in Chromium-based browsers while working in Firefox. Root cause: the global Content-Security-Policy form-action 'self' blocked the OmniAuth → identity-provider redirect — Chromium enforces form-action against every hop in a post-submit redirect chain, Firefox does not. The login page now relaxes form-action to the configured IdP origins only (GitHub, GitLab, the OIDC issuer host); strict form-action 'self' remains in force on every other page.

Security & hardening

  • Database-enforced case-insensitive email uniqueness (#593). A functional UNIQUE index on LOWER(email) replaces the previous raw-email index. This closes a workaround where, with both local login and OIDC enabled, two accounts differing only by letter case (Jane.Doe@x.com vs jane.doe@x.com) could coexist. The migration pre-flights for pre-existing case-variant duplicates and backfills legacy mixed-case rows.
  • CVE dispositions. Two newly-published base-image perl CVEs — CVE-2026-8376 (32-bit-only, won't-fix; not applicable to our 64-bit images) and CVE-2026-42496 (Archive::Tar symlink traversal; perl is transitive from ruby:slim and never invoked by the app) — are tracked as false_positive in docs/compliance/sparc-findings.yml. The Grype scan gate now honors that disposition registry as its single source of truth.

Upgrade notes

  • The email-uniqueness migration is a schema migration that runs synchronously at container boot (db:prepare). If any pre-existing case-variant duplicate emails exist, the migration fails fast with the offending list rather than silently merging accounts — resolve those before deploying. (Expected count: none.)
  • No configuration changes required. Requires a deploy to reach environments still on v1.8.2.

Closes #593.

Assets 2
Loading